Note that generate_user() has its own lock